Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center.

The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine.

The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator.

That setup makes traditional domain-based takedowns harder. The command-and-control (C2) channel does not depend on a fixed domain or server address, and operators can keep the same identity when moving to another server.

The seller references this in a cybercrime forum listing, claiming the controller can be moved by copying its Tox save file, with clients following without the need for a domain.

In this post, we look at how AvisLoader works, the MITRE ATT&CK techniques it uses, and the indicators security teams can use to detect it.

Delivery through ClickFix and Cloudflare

The specific ClickFix lure we found alongside AvisLoader was hosted on Cloudflare Workers and made to look like a DocuSign signing request.

A fake “Manual verification” dialog claims “Verification is handled by Cloudflare” and asks visitors to paste a “verification code” into a terminal. It presents running the command as a step needed to access the document.

What lands on the clipboard is a command that retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com. A download still takes place, but through the pasted command, outside the browser’s normal download flow.

Although the lure shows a macOS command, the exposed directory contained a Windows loader. We did not find a corresponding macOS payload among the recovered files.

Inside the loader

The Windows payload is a single 3.4 MB 64-bit executable. Its manifest specifies asInvoker, meaning it inherits the privileges of the process that launches it without requesting User Account Control (UAC) elevation at startup.

Its section table contains seventeen additional sections of identical size, with names associated with well-known packers, including Themida, VMProtect, Enigma, and UPX. None is marked executable. These names appear intended to confuse packer identification, although the names alone do not establish that any of those packers was used.

Underneath, it’s a Tox client. The executable statically links c-toxcore, the reference implementation of the Tox protocol, and retains the developer’s build path, C:\Users\dev\Desktop\c-toxcore.

Using Tox lets the loader communicate with its controller as another peer on the network. This removes reliance on a single centralized command-and-control address, but the network connections remain observable alongside the loader’s activity on the host.

Escalation, persistence, and stealth

AvisLoader’s persistence code targets shortcuts on the desktop and in the taskbar-pinned folder. The executable contains shortcut-backup strings and a VBScript launcher associated with the name VLCAssistant. These artifacts indicate a mechanism designed to launch the malware when a user opens a modified shortcut, then start the intended application so it appears to open normally.

The recovered files also include auto.exe, a small helper that references method 41 from UACME, a public User Account Control (UAC) bypass project. Its strings identify the ICMLuaUtil interface and the Component Object Model (COM) elevation mechanism associated with that technique. The helper also warns that updated Windows versions may mitigate the bypass, so its presence does not establish successful elevation.

A separate dynamic-link library (DLL), hmn_hook.dll, provides process-hiding functionality. It hooks NtQuerySystemInformation, a Windows function used to retrieve process information, and filters a specified process name from the results. This could hide that process from software using the hooked function, but the recovered files do not establish that the DLL was loaded into Task Manager or used to hide AvisLoader itself.

The AvisLoader command center

The recovered tools give us a view of AvisLoader’s endpoint capabilities. Its web panel, branded the AvisLoader Command Center, shows how operators are meant to manage clients, configure tasks, and distribute files. The dashboard includes counts of total, online, and offline clients, along with a world map.

A Clients table includes fields for hostname, country, central processing unit (CPU), graphics processing unit (GPU), antivirus, administrator status, and a public key. These fields bring host information into one view. The public-key field is consistent with Tox’s peer identity model.

The Tasks tab lets operators configure shell commands and select clients by hardware, location, and administrator status. Its controls indicate support for tasks that run when matching clients come online, allowing operators to prepare commands ahead of a client connecting.

The Files tab provides an interface for staging files and describes delivery “to clients over Tox.” This gives operators a way to prepare additional payloads for distribution.

Defenses and takeaways

AvisLoader gives security teams several opportunities for detection, from the initial ClickFix command to shortcut changes and unexpected Tox traffic. The delivery setup and recovered files point to four areas for monitoring:

• Treat document-signing or verification pages that ask users to paste commands into a terminal or the Windows Run dialog as suspicious. Users should report these requests before running the command.

• Investigate unfamiliar workers.dev and trycloudflare.com addresses when they appear in document-signing lures or commands that download and execute code. Both domains support legitimate services, so consider the page content and surrounding activity when assessing them.

• Monitor command shells and script interpreters that retrieve and execute remote code, especially when the activity follows a visit to a suspicious page. Check for unexpected Tox or other peer-to-peer traffic on the same device. A command pasted by a user may run without the browser appearing as its parent process.

• Hunt for modified desktop and taskbar shortcuts, associated .backup files, and references to VLCAssistant. Investigate matches for the recovered auto.exe and hmn_hook.dll samples, then examine the surrounding activity for elevation attempts or process-list hooks.

What we learned from AvisLoader

AvisLoader brings familiar malware techniques together around Tox. The recovered Windows sample includes shortcut-persistence artifacts, while its Command Center offers shell tasks and file delivery over an encrypted peer-to-peer connection.

For security teams, this means a legitimate messaging protocol can also carry operator commands and additional malware. Understanding that traffic means looking at the application behind it and what it does on the device, alongside the network connections it makes.

MITRE ATT&CK

Technique ID

Technique name

Supporting evidence

T1204.004

User Execution: Malicious Copy and Paste

The ClickFix lure instructs visitors to paste and run an attacker-supplied command.

T1547.009

Boot or Logon Autostart Execution: Shortcut Modification

Loader artifacts support the modification of desktop and taskbar shortcuts to launch malware when opened. Boot or logon execution was not established.

T1548.002

Abuse Elevation Control Mechanism: Bypass User Account Control

The bundled auto.exe helper implements the UACME method 41 bypass. Successful elevation was not confirmed.

T1014

Rootkit

The bundled hmn_hook.dll hooks NtQuerySystemInformation to filter a specified process name from returned results. Its deployment was not confirmed.

T1071

Application Layer Protocol

The loader incorporates c-toxcore for Tox-based command-and-control communications.

T1105

Ingress Tool Transfer

The Command Center offers file delivery to clients over Tox. Successful transfers were not confirmed.

Indicators of compromise

File indicators

Filename

SHA-256

Role

78324.exe

35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc

AvisLoader Windows client

auto.exe

f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975

Bundled elevation-bypass helper

hmn_hook.dll

cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5

Bundled process-hiding library

Host and analysis artifacts

Attribute

Value

Persistence-related launcher name

VLCAssistant

Shortcut backup extension

.backup, relevant alongside modified desktop or taskbar shortcuts

Embedded developer build path

C:\Users\dev\Desktop\c-toxcore, present inside the loader

hmn_hook.dll exports

HMN_HideStart, HMN_HideStatus, HMN_HideStop

Function hooked by hmn_hook.dll

NtQuerySystemInformation, a legitimate Windows function

Component Object Model (COM) class identifier referenced by auto.exe

{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, associated with the elevation-bypass technique

How Varonis can help

Varonis' Data Security Platform uses behavioral analytics to flag abnormal activity that matches these techniques, including unexpected process lineage from a browser or script interpreter, privilege escalation, and the data access that usually follows a loader.

Even when the command channel has no domain to block, Varonis catches what the intrusion does next. Varonis MDDR pairs that detection with an expert team that triages and contains incidents like this one.